Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sveltejs/kit

              main @ 8d3c865
            

Fixes

CVEs

CRITICAL

Peak severity

41.2%

Coverage

Highlights

Information Disclosure: 14 prior fixes. Scrutinize any change in this area.

packages/kit/src/runtime/server/respond.js: most-fixed (5 issues). Treat as high-risk during review.

17 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: Rendering serialized state variables into script tags during SSR without comprehensive HTML entity encoding allows direct execution of malicious payloads injected into the document hydration pipeline.

CSRF: Validation bypasses exist when HTTP origin validation is absent on specific methods, is case-sensitive, or parses Content-Type headers weakly, allowing cross-origin POST/PUT/PATCH/DELETE actions to succeed.

Information Disclosure: Implicit forwarding of sensitive headers (e.g. Cookie and Authorization) or leaking static/dynamic private env variables into client-side asset bundles compromises backend authentication tokens and API keys.